What’s Vulnerable › Vulnerabilities

CVE-2025-68704: Jervis has a Weak Random for Timing Attack Mitigation

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-13 · updated 2026-06-17
• Weakness: CWE-330

Description

Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographically secure for timing attack mitigation. This vulnerability is fixed in 2.2.

Affected products

• samrocketman jervis: before 2.2 — fixed in 2.2

How to fix

Upgrade to a fixed version: samrocketman jervis 2.2. Check the vendor advisory for mitigations.

References

• https://github.com/samrocketman/jervis/commit/c3981ff71de7b0f767dfe7b37a2372cb2a51974a
• https://github.com/samrocketman/jervis/security/advisories/GHSA-c9q6-g3hr-8gww

Get alerted when CVE-2025-68704 or the next vulnerability affects your stack